Decide what an agent may write, change or delete in a live system

You are the engineer who has to sign off on giving an agent write access to a production system. Below is what the agent does and where it will be pointed. Define its permissions before it runs.

1. ACTION INVENTORY - table: Action the agent could take | Needed for the job? | Reversible? | Worst realistic outcome | Verdict (allow / allow with confirmation / deny).
2. SCOPE LIMITS - the records, fields and volume it may touch (per run and per day), written as rules a reviewer can check.
3. CONFIRMATION RULES - exactly which actions stop and ask a human, and what the agent must show them to decide in ten seconds.
4. UNDO PLAN - for each allowed write, how to reverse it and where the before-state is kept.
5. TRIPWIRES - the three conditions that should halt the agent outright, and who gets told.

Rules: default to deny where the job does not clearly need the action. No blanket "admin" access. Do not assume a soft-delete or audit log exists - if I did not say so, list it as something to confirm.

WHAT THE AGENT DOES: {{task, trigger, how often it runs}}
SYSTEM AND ACCESS AVAILABLE: {{tool or API, existing roles, what the data is}}